3 ms·

MDM for laptops? No thanks. It's a world of security theatre - the main purpose of which seems to be to stop me doing my job. Also it invariably means Windows.

eswat 4y ago
MDM doesn't have to be a heavy-handed thing and solutions exist for macOS at least. Even something that just makes sure the OS and critical apps always have the latest security patches - and ideally pushes those changes when it’s not disruptive to the host – can go a long way.
- dissent 4y ago
  Doesn't have to be, invariably is in my experience. I prefer the approach of taking the phrase Zero Trust literally.
  - r4vik 4y ago
    From what I can remember when I set this up last all our MDM did was: - Ensure full disk encryption - Time limit on how long people can defer OS upgrades - Report on software installed and versions - Enforce somewhat complex password - Enforce password after screen has become locked - Allow us to remote wipe the machine if lost/stolen It didn't stop you from installing / uninstalling anything - even itself. Although if your machine stopped phoning home for a certain amount of time we had some alerts set up for the IT support team to follow up.
tptacek 4y ago
At startups, MDM almost invariably means Macs; it's usually some mixture of Jamf and osquery.
- r4vik 4y ago
  unfortunately yes - I was in charge of this decision as a previous employer and I went with Macs+JAMF even though I'm a die hard Linux user. My work around was to run a fullscreen Linux VM but that does defeat the purpose somewhat. I'm hoping things are better now - I think Canonical have some sort of MDM for Ubuntu but I couldn't figure out how to pay for it.
  - senorsmile 4y ago
    I'm trialing fleetdm atm. It works on all 3.
    - bradwood 4y ago
      I'm also in the market for some kinda MDM setup that will work on BYOD dev Linux hosts without annoying developers... How are you finding fleetdm?

eswat 4y ago

MDM doesn't have to be a heavy-handed thing and solutions exist for macOS at least. Even something that just makes sure the OS and critical apps always have the latest security patches - and ideally pushes those changes when it’s not disruptive to the host – can go a long way.

dissent 4y ago
Doesn't have to be, invariably is in my experience. I prefer the approach of taking the phrase Zero Trust literally.
- r4vik 4y ago
  From what I can remember when I set this up last all our MDM did was: - Ensure full disk encryption - Time limit on how long people can defer OS upgrades - Report on software installed and versions - Enforce somewhat complex password - Enforce password after screen has become locked - Allow us to remote wipe the machine if lost/stolen It didn't stop you from installing / uninstalling anything - even itself. Although if your machine stopped phoning home for a certain amount of time we had some alerts set up for the IT support team to follow up.

tptacek 4y ago

At startups, MDM almost invariably means Macs; it's usually some mixture of Jamf and osquery.

r4vik 4y ago
unfortunately yes - I was in charge of this decision as a previous employer and I went with Macs+JAMF even though I'm a die hard Linux user. My work around was to run a fullscreen Linux VM but that does defeat the purpose somewhat. I'm hoping things are better now - I think Canonical have some sort of MDM for Ubuntu but I couldn't figure out how to pay for it.
- senorsmile 4y ago
  I'm trialing fleetdm atm. It works on all 3.
  - bradwood 4y ago
    I'm also in the market for some kinda MDM setup that will work on BYOD dev Linux hosts without annoying developers... How are you finding fleetdm?